Analysis
-
max time kernel
85s -
max time network
137s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
-
submitted
01-02-2024 04:02
General
-
Target
wexhfyjiflbfxbkpbmwi.exe
-
Size
10.1MB
-
MD5
5a3566fab9f55ddcf287aa96a60ad579
-
SHA1
247839d601b36bd2c0411241e4a89b28c6ff70da
-
SHA256
54df213162ccbb081e13f8cb5bd84022f7e6587a68a04522da08f9fd56b8ef53
-
SHA512
46f5b7e2524f29ca069da75a0a4c3958d2dada86c7bc7db814ed73a737e5906b6c6cb20cb113d5982975ed6443be0deac9c56338a7c2b5424cfd86232a52b807
-
SSDEEP
196608:VEzDgHsNFdc2k9dYnqFc9PzzGZnjurXuwLs4PCE4+HtrHpRpfxGjpeQN8:4RNFdav26pjujuwhaE4+HtJRppGsl
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Deletes itself 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\expand.exe"C:\Windows\system32\expand.exe"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\wexhfyjiflbfxbkpbmwi.exe"C:\Users\Admin\AppData\Local\Temp\wexhfyjiflbfxbkpbmwi.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.9MB
-
Filesize
4KB
-
Filesize
17.9MB
-
Filesize
17.9MB
-
Filesize
17.9MB
-
Filesize
19.6MB
-
Filesize
4KB